CVE-2025-15434: Yonyou KSOA PrintZPYG.jsp sql injection

Published Jan 2, 2026

Updated

A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argument zpjhid results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA=9.0

Event History

Jan 2, 2026

CVE Published

via MITRE·07:02 AM

Data Sourced

via MITRE·07:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-15434?

CVE-2025-15434 has a high severity due to its potential for remote SQL injection exploitation.

How do I fix CVE-2025-15434?

To fix CVE-2025-15434, it is recommended to apply security patches provided by Yonyou or eliminate the vulnerable function in Yonyou KSOA version 9.0.

Which software is affected by CVE-2025-15434?

CVE-2025-15434 affects Yonyou KSOA version 9.0.

What kind of vulnerability is CVE-2025-15434?

CVE-2025-15434 is categorized as an SQL injection vulnerability.

Can CVE-2025-15434 be exploited remotely?

Yes, CVE-2025-15434 can be exploited remotely.